On 09/03/2013 10:23 PM, Daniel Martin wrote:
Hello again,
I am working on 10Gbps systems. I am conducting tests that push line rate
speeds and I am simply trying to come up with a way to basically prove the
data is being received at line rate speeds. From previous posts I realize
I am fairly sure my sniffer machines will not be able to handle capturing
all data "I have configured the systems just about every way I know how
within reason" and I am still getting about 88% packet loss. I will need
to purchase additional parts to make this work. However, I am now thinking
since all packets are of uniform size about 24,000 Bytes UDP. Would it be
practical to try and write a filter that captures the packet, but only
writes the IP Header information to a file and not all the data inside the
packet? I am thinking that since most of the data being written is the
packet payload maybe I might have better luck simply writing the IP Header
Information, or is this not practical? Thanks for any advice you can give
me in advance.
If only headers are sufficient for you, you could try out the following bpfc
filter:
# cat foo
ld poff
ret a
# bpfc foo > bar
# netsniff-ng ... -f bar ...
That should already improve capturing. Note that you need a recent kernel to
use this BPF extension.
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
